Medium severity6.3NVD Advisory· Published Mar 6, 2024· Updated Jun 17, 2026
CVE-2024-28152
CVE-2024-28152
Description
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-sourceMaven | < 871.v28d74e8b_4226 | 871.v28d74e8b_4226 |
Affected products
5cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*+ 2 more
- cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*range: <848.850.v6a_a_2a_234a_c81
- cpe:2.3:a:jenkins:bitbucket_branch_source:856.v04c46c86f911:*:*:*:*:jenkins:*:*
- cpe:2.3:a:jenkins:bitbucket_branch_source:866.vdea_7dcd3008e:*:*:*:*:jenkins:*:*
- ghsa-coordsRange: < 871.v28d74e8b_4226
- Range: 871.v28d74e8b_4226
Patches
Vulnerability mechanics
References
5- www.openwall.com/lists/oss-security/2024/03/06/3nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-m4rm-x2rr-357wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-28152ghsaADVISORY
- www.jenkins.io/security/advisory/2024-03-06/nvdVendor AdvisoryWEB
- github.com/jenkinsci/bitbucket-branch-source-plugin/commit/28d74e8b4226bfc7524b412e34f7090784cc1a08ghsaWEB
News mentions
1- Jenkins Security Advisory 2024-03-06Jenkins Security Advisories · Mar 6, 2024